Data controller
The data controller is Ιθάκη Ταξιδιωτική Ι.Κ.Ε. (trading as ‘Ithaka’), with its head office at Xenofontos 12, 105 57 Athens, Greece.
For any question about your personal data or to exercise your rights, write to info@ithaka-travel.example, or to the address of our office.
What data we process
We process only the data needed for what you ask us to do:
- Contact and booking details: first and last name, address, email, phone, the trip and departure you chose, booking code, requests and notes.
- Traveller details: for each traveller, first and last name (as on the document), date of birth, sex, nationality, number and expiry date of the passport or travel document, room type.
- Health and special needs: the dietary needs, mobility difficulties or health conditions that you choose to tell us about so that we can adapt the trip. These are special category data: we process them only with your explicit consent.
- Payment data: amounts, dates and payment method. For the card we keep only the type and the last four digits: the full number and the security code do not remain on our systems.
- Account: email, password (stored only in encrypted form), profile details, saved travellers, saved trips and your choice about promotional messages.
- Messages and requests: what you write to us using the forms (contact, tailor-made trip, groups, callback, waiting list), our replies, a copy of the emails we send you and the IP address the requests come from, to protect us from abuse.
- Newsletter: email address, language and date of subscription.
- Reviews: name, country, rating and the text you choose to publish.
- Technical data: IP address, browser and device type, date and time of access. They are used for security, for the operation of the website and for access to your account.
Why we process your data, and on what legal basis
Each processing activity has a purpose and a legal basis under Regulation (EU) 2016/679 (GDPR):
| Purpose | Legal basis |
|---|---|
| Managing your booking, the travel contract, payments and support before, during and after the trip | Performance of a contract or pre-contractual steps requested by you (Art. 6(1)(b)) |
| Sharing with service providers (airlines, hotels, guides) the data needed to carry out the trip | Performance of a contract (Art. 6(1)(b)) |
| Replying to your requests and complaints | Pre-contractual steps or performance of a contract; legitimate interest in replying (Art. 6(1)(b) and (f)) |
| Sending you service messages about your trip: confirmations, reminders, documents, an invitation to leave a review | Performance of a contract; for the review invitation, legitimate interest (Art. 6(1)(b) and (f)) |
| Meeting our tax and accounting obligations and the requirements of package travel law | Legal obligation (Art. 6(1)(c)) |
| Taking account of the health, dietary or mobility needs you tell us about, so that we can adapt the trip | Explicit consent, which you can withdraw at any time (Art. 9(2)(a)) |
| Keeping the website secure, preventing abuse and fraud, defending our rights | Legitimate interest (Art. 6(1)(f)) |
| Sending you the newsletter and offers | Consent, only if you subscribe; you can withdraw it at any time (Art. 6(1)(a)) |
| Publishing your review, if you decide to leave one | Consent (Art. 6(1)(a)) |
Who we share your data with
Your data is processed by our authorised staff and shared, only as far as necessary, with:
- providers of the trip’s services: airlines and transport companies, hotels, guides and local agencies, insurers, who use the data to deliver your trip;
- technical providers (hosting and infrastructure, email delivery, IT support), who act as processors on our instructions;
- payment services (banks, card networks, PayPal, IRIS), which process the payment data as independent controllers for their part;
- advisers (for example an accountant and a lawyer) and public authorities, when the law requires it or to defend one of our rights.
We do not sell your data and we do not pass it on to third parties for marketing purposes.
Transfers outside the European Union
Many of our tour destinations are outside the European Economic Area. To carry out the trip you have booked, we have to pass on the essential data (for example names, dates of birth and document details) to airlines, hotels and local operators, including in countries that do not offer the same level of data protection. In these cases the transfer is necessary for the performance of the contract you have entered into with us (Art. 49(1)(b) GDPR) and we share only what is needed.
On request, we will explain which data is shared and with whom.
How long we keep your data
| Data | Retention period |
|---|---|
| Travel contract and payment data | For as long as our relationship lasts, and then for the periods required by tax and accounting obligations and, if necessary, until the time limits for asserting or defending rights have expired. |
| Health and special needs | Until the end of the trip; after that we delete or anonymise them, unless they are needed for a complaint or a dispute that is still ongoing. |
| Account | Until you close it: you can ask us to do so at any time. |
| Messages and requests | 24 months after the last message. |
| Newsletter | Until you unsubscribe (the link is in every email). |
| Reviews | For as long as they remain published; you can ask for them to be removed. |
| Account sign-ins | Until the sign-in expires: 30 days at most. |
| Technical security logs | For the time strictly necessary for security, normally no more than 12 months. |
Your rights
At any time, you can:
- ask for access to your data and a copy of it;
- ask for inaccurate or incomplete data to be corrected;
- ask for your data to be erased, when no legal obligations or legitimate interests require us to keep it;
- ask for processing to be restricted in some cases;
- ask to receive the data you have given us in a commonly used format (data portability);
- object to processing based on legitimate interest;
- withdraw the consent you have given, without affecting the lawfulness of anything done before.
To exercise your rights, write to us at info@ithaka-travel.example, giving your name, the email address you used for your booking and what you are asking for; if we need to confirm your identity, we will ask you for a document. We reply within one month, which can be extended by a further two months for very complex requests. You can correct a lot of your details yourself in your account.
We do not make decisions based solely on automated processing that have legal effects on you.
Complaint to the supervisory authority
You have the right to lodge a complaint with the supervisory authority. In Greece this is the Hellenic Data Protection Authority (HDPA; in Greek Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, ΑΠΔΠΧ): www.dpa.gr. You can also contact the authority of the European Union country where you live or work, or where the alleged infringement took place.
If you wish, write to us first: we will try to solve the problem straight away.
Required and optional data
To book, we need your name, your contact details and the traveller details requested by the forms: without this data we cannot conclude the contract or issue tickets. Data about health and special needs, subscribing to the newsletter and reviews are optional.
Security
We use secure connections (HTTPS), store passwords only in encrypted form, limit access to data to authorised staff according to their role, and keep a record of the operations carried out in the admin panel. We do not store the full card number or the security code.
Maps and third-party services
We do not use traffic analytics or advertising tools, and the website’s fonts are hosted on our own servers.
Maps are provided by OpenStreetMap and OpenTopoMap: when a page shows a map, your browser loads the images directly from their servers, which receive your IP address, information about your browser and the name of our website. We do not receive or store this information. Read the OpenStreetMap Foundation privacy policy and the OpenTopoMap website. The information shown on the maps is always available in list form too.
Links to WhatsApp and to social media profiles lead to services run by other controllers, with their own privacy notices: until you open them, none of their servers is contacted.
When you pay with PayPal or IRIS, we send you to the provider’s secure page, which handles the payment data under its own privacy notice.
Minors
The website is intended for adults. We receive minors’ data only from a parent or from whoever is responsible for them, in order to book a trip.
Updates to this policy
We update this policy when the way we process data changes; the date of the last revision is at the top of the page. If the changes are significant, we point this out prominently on the website.